sneakoscope 2.0.13 → 2.0.15

package/dist/scripts/codex-app-ui-preservation-check.js

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// SKS must never remove/block/hide the Codex App UI. normalizeCodexFastModeUiConfig now:
-//   - sets Codex App feature flags / [user.fast_mode] / suppress-warning ONLY IF ABSENT
-//     (never re-enables a feature the user disabled in the App),
-//   - never auto-enables marketplace plugins by default (opt-in SKS_MANAGE_CODEX_APP_PLUGINS=1),
-//   - still seeds defaults on a fresh/empty config (fresh-install enablement preserved).
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const helpers = await importDist('cli/install-helpers.js');
-const normalize = helpers.normalizeCodexFastModeUiConfig;
-function featureValue(text, key) {
-    const lines = String(text).split('\n');
-    const start = lines.findIndex((l) => l.trim() === '[features]');
-    if (start === -1)
-        return undefined;
-    for (let i = start + 1; i < lines.length; i += 1) {
-        if (/^\s*\[.+\]\s*$/.test(lines[i]))
-            break;
-        const m = lines[i].match(new RegExp(`^\\s*${key}\\s*=\\s*(\\S+)`));
-        if (m)
-            return m[1];
-    }
-    return undefined;
-}
-const hasPluginTables = (text) => /\[plugins\."[^"]+"\]/.test(String(text));
-const results = [];
-const prevEnv = process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-delete process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-// 1) A feature the user disabled in the App must stay disabled (no override).
-{
-    const user = '[features]\nguardian_approval = false\nbrowser_use_external = false\n';
-    const out = normalize(user);
-    const ok = featureValue(out, 'guardian_approval') === 'false' && featureValue(out, 'browser_use_external') === 'false';
-    results.push({ case: 'preserves_disabled_features', ok, guardian: featureValue(out, 'guardian_approval') });
-}
-// 2) Default install must NOT auto-enable any marketplace plugins.
-{
-    const out = normalize('model = "gpt-5.5"\n');
-    results.push({ case: 'no_plugins_by_default', ok: !hasPluginTables(out) });
-}
-// 3) A user's disabled plugin must be left untouched (not reverted to enabled).
-{
-    const user = '[plugins."chrome@openai-bundled"]\nenabled = false\n';
-    const out = normalize(user);
-    const ok = /\[plugins\."chrome@openai-bundled"\][\s\S]*enabled = false/.test(out);
-    results.push({ case: 'preserves_user_disabled_plugin', ok });
-}
-// 4) suppress_unstable_features_warning is not forced over a user's explicit false.
-{
-    const out = normalize('suppress_unstable_features_warning = false\n');
-    results.push({ case: 'preserves_user_suppress_choice', ok: /suppress_unstable_features_warning = false/.test(out) });
-}
-// 5) Fresh/empty config still gets [features] + hooks + [profiles.sks-fast-high] (fresh enablement).
-{
-    const out = normalize('');
-    const fastProfile = tableBody(out, 'profiles.sks-fast-high');
-    const ok = /\[features\]/.test(out)
-        && featureValue(out, 'hooks') === 'true'
-        && /\[profiles\.sks-fast-high\]/.test(out)
-        && /service_tier\s*=\s*"fast"/.test(fastProfile)
-        && !/sandbox_mode\s*=/.test(fastProfile);
-    results.push({ case: 'fresh_config_seeds_defaults', ok });
-}
-// 6) Opt-in enables plugins on a fresh config, but still preserves a user-disabled one.
-{
-    process.env.SKS_MANAGE_CODEX_APP_PLUGINS = '1';
-    const fresh = normalize('model = "gpt-5.5"\n');
-    const userDisabled = normalize('[plugins."chrome@openai-bundled"]\nenabled = false\n');
-    delete process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-    const ok = hasPluginTables(fresh) && /\[plugins\."chrome@openai-bundled"\][\s\S]*enabled = false/.test(userDisabled);
-    results.push({ case: 'optin_enables_but_preserves_user', ok });
-}
-if (prevEnv === undefined)
-    delete process.env.SKS_MANAGE_CODEX_APP_PLUGINS;
-else
-    process.env.SKS_MANAGE_CODEX_APP_PLUGINS = prevEnv;
-const ok = results.every((r) => r.ok);
-if (!ok) {
-    console.error(JSON.stringify({ ok: false, message: 'Codex App UI preservation regression failed', results }, null, 2));
-    process.exit(1);
-}
-emitGate('codex-app:ui-preservation', { cases: results.map((r) => r.case) });
-function tableBody(text, table) {
-    const lines = String(text || '').split('\n');
-    const start = lines.findIndex((line) => line.trim() === `[${table}]`);
-    if (start < 0)
-        return '';
-    const body = [];
-    for (let i = start + 1; i < lines.length; i += 1) {
-        if (/^\s*\[.+\]\s*$/.test(lines[i]))
-            break;
-        body.push(lines[i]);
-    }
-    return body.join('\n');
-}
-//# sourceMappingURL=codex-app-ui-preservation-check.js.map

package/dist/scripts/codex-control-all-pipelines-check.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, packageScripts, readText, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const scripts = packageScripts();
-const required = [
-    'codex-control:capability',
-    'codex-control:no-legacy-fallback',
-    'codex-control:structured-output',
-    'codex-control:event-stream-ledger',
-    'codex-control:thread-registry',
-    'codex-control:side-effect-scope',
-    'codex-control:empty-result-retry',
-    'codex-control:stream-idle-watchdog',
-    'codex-control:tool-call-sequence-repair',
-    'codex-control:keepalive-no-cot-leak'
-];
-for (const name of required)
-    assertGate(Boolean(scripts[name]), `required control gate missing: ${name}`);
-const sources = {
-    team: readText('src/core/commands/team-command.ts'),
-    qa: readText('src/core/commands/qa-loop-command.ts'),
-    research: readText('src/core/commands/research-command.ts'),
-    naruto: readText('src/core/commands/naruto-command.ts'),
-    dfix: readText('src/core/commands/dfix-command.ts'),
-    workerRouter: readText('src/core/agents/native-worker-backend-router.ts')
-};
-assertGate(sources.team.includes("mock ? 'fake' : 'codex-sdk'"), 'Team must route native agents through codex control backend');
-assertGate(sources.qa.includes("mock ? 'fake' : 'codex-sdk'"), 'QA must route native agents through codex control backend');
-assertGate(sources.research.includes("mock ? 'fake' : 'codex-sdk'"), 'Research must route native agents through codex control backend');
-assertGate(sources.naruto.includes("backend: 'codex-sdk'"), 'Naruto defaults must name codex-sdk control backend');
-assertGate(sources.workerRouter.includes('runCodexTask({'), 'native worker router must call runCodexTask');
-const fixture = await runFakeCodexSdkTaskFixture('control-all-pipelines');
-assertGate(fixture.result.ok === true, 'all pipeline control fixture must pass', fixture.result);
-assertGate(fixture.proof.reliability_shield?.ok === true, 'all pipeline fixture must include reliability shield proof', fixture.proof);
-emitGate('codex-control:all-pipelines', { scripts: required.length, sdk_thread_id: fixture.result.sdkThreadId });
-//# sourceMappingURL=codex-control-all-pipelines-check.js.map

package/dist/scripts/codex-control-capability-check.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-sdk-capability.js');
-const capability = await mod.detectCodexSdkCapability();
-assertGate(capability.ok, 'Codex Control Plane requires Codex SDK capability', capability);
-assertGate(capability.package_name === '@openai/codex-sdk', 'Codex SDK package name mismatch', capability);
-assertGate(capability.dynamic_import_ok === true, 'Codex SDK dynamic import failed', capability);
-emitGate('codex-control:capability', { package_version: capability.package_version, node_version: capability.node_version });
-//# sourceMappingURL=codex-control-capability-check.js.map

package/dist/scripts/codex-control-empty-result-retry-check.js

@@ -1,43 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-reliability-shield.js');
-let attempts = 0;
-const result = await mod.runWithCodexReliabilityShield(baseTask(), async () => {
-    attempts += 1;
-    if (attempts === 1)
-        return { ok: false, events: [], finalResponse: '', structuredOutput: null, blockers: [] };
-    return {
-        ok: true,
-        sdkThreadId: 'sdk-thread-empty-retry',
-        sdkRunId: 'sdk-run-empty-retry',
-        events: [
-            { type: 'thread.started', thread_id: 'sdk-thread-empty-retry' },
-            { type: 'item.completed', item: { type: 'agent_message', text: '{"status":"done"}' } },
-            { type: 'turn.completed' }
-        ],
-        finalResponse: '{"status":"done"}',
-        structuredOutput: { status: 'done' },
-        blockers: []
-    };
-});
-assertGate(attempts === 2, 'empty SDK result must retry once before meaningful output', { attempts, result });
-assertGate(result.reliabilityShield.retry_count === 1, 'retry count mismatch', result.reliabilityShield);
-assertGate(result.reliabilityShield.no_duplicate_streamed_output === true, 'empty retry must not duplicate meaningful output', result.reliabilityShield);
-emitGate('codex-control:empty-result-retry', { attempts, retry_count: result.reliabilityShield.retry_count });
-function baseTask() {
-    return {
-        route: '$Agent',
-        tier: 'worker',
-        missionId: 'M-empty-result-retry',
-        cwd: process.cwd(),
-        prompt: 'empty retry fixture',
-        outputSchemaId: 'sks.agent-worker-result.v1',
-        outputSchema: {},
-        sandboxPolicy: 'read-only',
-        requestedScopeContract: { read_only: true },
-        reliabilityPolicy: { maxEmptyResultRetries: 1, idleTimeoutMs: 5000, timeoutClass: 'short' },
-        mutationLedgerRoot: process.cwd()
-    };
-}
-//# sourceMappingURL=codex-control-empty-result-retry-check.js.map

package/dist/scripts/codex-control-event-stream-ledger-check.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const fixture = await runFakeCodexSdkTaskFixture('control-event-stream');
-assertGate(fixture.events.length >= 1, 'Control Plane event ledger must contain translated events', fixture.events);
-assertGate(fixture.proof.stream_event_count === fixture.result.streamEventCount, 'proof stream count mismatch', fixture.proof);
-assertGate(fixture.proof.translated_event_count === fixture.events.length, 'translated event count mismatch', fixture.proof);
-assertGate(fixture.proof.reliability_shield?.attempts?.[0]?.event_count >= 1, 'reliability shield must observe SDK events', fixture.proof);
-emitGate('codex-control:event-stream-ledger', { event_count: fixture.events.length, event_types: fixture.result.eventTypes });
-//# sourceMappingURL=codex-control-event-stream-ledger-check.js.map

package/dist/scripts/codex-control-keepalive-no-cot-leak-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const shield = await importDist('core/codex-control/codex-reliability-shield.js');
-const translator = await importDist('core/codex-control/codex-event-translator.js');
-const reasoningEvent = { type: 'reasoning.delta', item: { type: 'reasoning', text: 'private reasoning fixture that must not leak' } };
-const heartbeats = shield.buildKeepaliveHeartbeats([reasoningEvent]);
-const translated = translator.translateCodexSdkEvent(reasoningEvent);
-assertGate(heartbeats.length === 1, 'reasoning events must produce keepalive heartbeats', heartbeats);
-assertGate(heartbeats[0].content_redacted === true, 'heartbeat must redact reasoning content', heartbeats);
-assertGate(translated.message_tail === '[thinking]', 'translated reasoning event must show status only', translated);
-assertGate(!JSON.stringify(heartbeats).includes('private reasoning fixture'), 'heartbeat leaked reasoning content', heartbeats);
-emitGate('codex-control:keepalive-no-cot-leak', { heartbeat_count: heartbeats.length, content_redacted: true });
-//# sourceMappingURL=codex-control-keepalive-no-cot-leak-check.js.map

package/dist/scripts/codex-control-no-legacy-fallback-check.js

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, readText, root } from './sks-1-18-gate-lib.js';
-const runtimeFiles = [
-    'src/core/agents/agent-orchestrator.ts',
-    'src/core/agents/native-worker-backend-router.ts',
-    'src/core/commands/team-command.ts',
-    'src/core/commands/qa-loop-command.ts',
-    'src/core/commands/research-command.ts',
-    'src/core/commands/naruto-command.ts',
-    'src/core/commands/mad-sks-command.ts'
-];
-const violations = [];
-for (const file of runtimeFiles) {
-    const text = readText(file);
-    if (text.includes("runCodexExecAgent"))
-        violations.push(`${file}:runCodexExecAgent`);
-    if (text.includes("mock ? 'fake' : 'codex-exec'"))
-        violations.push(`${file}:legacy-default`);
-    if (text.includes('codex-exec|fake'))
-        violations.push(`${file}:legacy-help`);
-}
-const controlFiles = fs.readdirSync(path.join(root, 'src', 'core', 'codex-control'));
-assertGate(controlFiles.includes('codex-control-plane.ts'), 'Codex Control Plane source missing');
-assertGate(controlFiles.includes('codex-reliability-shield.ts'), 'Codex Reliability Shield source missing');
-assertGate(readText('src/core/agents/native-worker-backend-router.ts').includes("legacy_codex_exec_runtime_removed"), 'explicit codex-exec request must block');
-assertGate(violations.length === 0, 'legacy Codex exec fallback still reachable', { violations });
-emitGate('codex-control:no-legacy-fallback', { checked_files: runtimeFiles.length });
-//# sourceMappingURL=codex-control-no-legacy-fallback-check.js.map

package/dist/scripts/codex-control-side-effect-scope-check.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-sdk-sandbox-policy.js');
-const base = {
-    route: '$Agent',
-    tier: 'worker',
-    missionId: 'M-control-side-effect',
-    cwd: process.cwd(),
-    prompt: 'side-effect scope fixture',
-    outputSchemaId: 'sks.agent-worker-result.v1',
-    outputSchema: {},
-    mutationLedgerRoot: process.cwd()
-};
-const readOnly = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'read-only', requestedScopeContract: { read_only: true } });
-const workspaceMissing = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: [], write_paths: [] } });
-const workspaceScoped = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: ['src/core'], write_paths: ['src/core'] } });
-const fullBlocked = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'full-access', requestedScopeContract: { read_only: false, user_confirmed_full_access: true, mad_sks_authorized: false } });
-const fullMad = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'full-access', requestedScopeContract: { read_only: false, user_confirmed_full_access: true, mad_sks_authorized: true } });
-assertGate(readOnly.ok && readOnly.sandboxMode === 'read-only', 'read-only sandbox mapping failed', readOnly);
-assertGate(!workspaceMissing.ok && workspaceMissing.blockers.includes('codex_sdk_workspace_write_scope_contract_missing'), 'workspace-write must require scoped paths', workspaceMissing);
-assertGate(workspaceScoped.ok && workspaceScoped.sandboxMode === 'workspace-write', 'workspace-write scoped mapping failed', workspaceScoped);
-assertGate(!fullBlocked.ok && fullBlocked.blockers.includes('codex_sdk_full_access_requires_explicit_mad_scope'), 'full-access must require explicit MAD scope', fullBlocked);
-assertGate(fullMad.ok && fullMad.sandboxMode === 'danger-full-access', 'MAD-scoped full access must map to danger-full-access', fullMad);
-emitGate('codex-control:side-effect-scope', { read_only: true, workspace_scope_required: true, mad_full_access_required: true });
-//# sourceMappingURL=codex-control-side-effect-scope-check.js.map

package/dist/scripts/codex-control-stream-idle-watchdog-check.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-reliability-shield.js');
-const policy = { maxEmptyResultRetries: 1, idleTimeoutMs: 1000, timeoutClass: 'short' };
-const idleBeforeOutput = mod.evaluateCodexReliabilityAttempt({ ok: false, finalResponse: '', structuredOutput: null, blockers: [] }, [
-    { type: 'thread.started', ts: '2026-06-03T00:00:00.000Z' },
-    { type: 'turn.started', ts: '2026-06-03T00:00:02.500Z' }
-], policy, 1);
-const idleAfterPartial = mod.evaluateCodexReliabilityAttempt({ ok: false, finalResponse: 'partial', structuredOutput: null, blockers: [] }, [
-    { type: 'thread.started', ts: '2026-06-03T00:00:00.000Z' },
-    { type: 'item.completed', ts: '2026-06-03T00:00:00.100Z', item: { type: 'agent_message', text: 'partial' } },
-    { type: 'turn.started', ts: '2026-06-03T00:00:02.500Z' }
-], policy, 1);
-assertGate(idleBeforeOutput.retryable === true && idleBeforeOutput.retry_reason === 'stream_idle_before_meaningful_event', 'idle before output must be retryable', idleBeforeOutput);
-assertGate(idleAfterPartial.retryable === false && idleAfterPartial.blockers.includes('codex_reliability_idle_after_partial_output'), 'idle after partial output must block', idleAfterPartial);
-emitGate('codex-control:stream-idle-watchdog', { retryable_before_output: true, blocks_after_partial: true });
-//# sourceMappingURL=codex-control-stream-idle-watchdog-check.js.map

package/dist/scripts/codex-control-structured-output-check.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const fixture = await runFakeCodexSdkTaskFixture('control-structured-output');
-assertGate(fixture.result.ok === true, 'Codex Control Plane fake run must pass', fixture.result);
-assertGate(fixture.result.structuredOutputValid === true, 'structured output must validate', fixture.result);
-assertGate(fixture.proof.output_schema_id === 'sks.agent-worker-result.v1', 'control proof output schema mismatch', fixture.proof);
-assertGate(fixture.proof.reliability_shield?.ok === true, 'reliability shield proof must pass', fixture.proof);
-assertGate(fixture.proof.ultra_router?.selected_profile, 'ultra router proof missing from control proof', fixture.proof);
-emitGate('codex-control:structured-output', { output_schema_id: fixture.proof.output_schema_id, profile: fixture.proof.ultra_router.selected_profile });
-//# sourceMappingURL=codex-control-structured-output-check.js.map

package/dist/scripts/codex-control-thread-registry-check.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
-const fixture = await runFakeCodexSdkTaskFixture('control-thread-registry', { zellijPaneId: 'pane-2-0' });
-const thread = fixture.registry.threads[0] || {};
-assertGate(fixture.registry.thread_count === 1, 'thread registry must record one thread', fixture.registry);
-assertGate(thread.sdk_thread_id === fixture.result.sdkThreadId, 'thread registry sdk_thread_id mismatch', { thread, result: fixture.result });
-assertGate(thread.zellij_pane_id === 'pane-2-0', 'thread registry must link zellij pane id when present', thread);
-assertGate(thread.output_schema_id === 'sks.agent-worker-result.v1', 'thread registry output schema mismatch', thread);
-emitGate('codex-control:thread-registry', { thread_count: fixture.registry.thread_count, sdk_thread_id: thread.sdk_thread_id });
-//# sourceMappingURL=codex-control-thread-registry-check.js.map

package/dist/scripts/codex-control-tool-call-sequence-repair-check.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-reliability-shield.js');
-const repaired = mod.repairToolCallSequence([
-    { type: 'thread.started' },
-    { type: 'item.completed', item: { id: 'call-1', type: 'mcp_tool_call', tool: 'fixture' } },
-    { type: 'item.completed', item: { id: 'call-2', type: 'mcp_tool_call', tool: 'fixture' } },
-    { type: 'tool_result.completed', item: { tool_call_id: 'call-1', type: 'tool_result', text: 'ok' } }
-]);
-assertGate(repaired.repairedToolResultCount === 1, 'one missing parallel tool result must be repaired', repaired);
-assertGate(repaired.events.some((event) => event.type === 'tool_result.stubbed' && event.item?.tool_call_id === 'call-2'), 'missing tool result stub not found', repaired);
-emitGate('codex-control:tool-call-sequence-repair', { repaired_tool_result_count: repaired.repairedToolResultCount });
-//# sourceMappingURL=codex-control-tool-call-sequence-repair-check.js.map

package/dist/scripts/codex-environment-scoped-approvals-check.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, readText } from './lib/codex-sdk-gate-lib.js';
-const proof = readText('src/core/codex-control/codex-control-proof.ts');
-const sandbox = readText('src/core/codex-control/codex-sdk-sandbox-policy.ts');
-assertGate(proof.includes('sandbox:'), 'Codex control proof must include sandbox scope');
-assertGate(proof.includes('env:'), 'Codex control proof must include environment proof');
-assertGate(sandbox.includes('mad_sks_authorized') || sandbox.includes('user_confirmed_full_access'), 'Sandbox policy must include scoped authorization signals');
-emitGate('codex:environment-scoped-approvals', { proof: ['sandbox', 'env', 'scoped_authorization'] });
-//# sourceMappingURL=codex-environment-scoped-approvals-check.js.map

package/dist/scripts/codex-exec-output-schema-actual-syntax-check.js

@@ -1,33 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { ensureDistFresh, root } from './lib/ensure-dist-fresh.js';
-const freshness = ensureDistFresh({ rebuild: true });
-if (!freshness.ok) {
-    console.log(JSON.stringify({ schema: 'sks.codex-exec-output-schema-actual-syntax-check.v1', ok: false, blocker: 'dist_not_fresh', freshness }, null, 2));
-    process.exit(1);
-}
-const mod = await import(pathToFileURL(path.join(root, 'dist', 'core', 'codex-exec-output-schema.js')).href);
-const syntax = await mod.detectCodexExecOutputSchemaSyntax();
-const schemaPath = path.join(root, 'schemas', 'codex', 'agent-result.schema.json');
-const freshArgs = await mod.buildCodexExecOutputSchemaArgs({ prompt: 'Return {}', outputSchemaPath: schemaPath, outputFile: path.join(root, '.sneakoscope', 'tmp', 'codex-fresh.json') });
-const resumeArgs = await mod.buildCodexExecResumeOutputSchemaArgs({ sessionId: 'fixture-session', prompt: 'Return {}', outputSchemaPath: schemaPath, outputFile: path.join(root, '.sneakoscope', 'tmp', 'codex-resume.json') });
-const report = {
-    schema: 'sks.codex-exec-output-schema-actual-syntax-check.v1',
-    ok: syntax.ok && (syntax.status === 'integration_optional' || syntax.exec.output_schema_supported || syntax.resume.output_schema_supported),
-    syntax,
-    exec_args_prefix: freshArgs.slice(0, 4),
-    resume_args_prefix: resumeArgs.slice(0, 5),
-    exec_output_schema_supported: syntax.exec.output_schema_supported,
-    exec_resume_output_schema_supported: syntax.resume.output_schema_supported,
-    degraded_supported: syntax.status === 'degraded_supported'
-};
-const out = path.join(root, '.sneakoscope', 'reports', 'codex-exec-output-schema-actual-syntax.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-console.log(JSON.stringify(report, null, 2));
-if (!report.ok)
-    process.exitCode = 1;
-//# sourceMappingURL=codex-exec-output-schema-actual-syntax-check.js.map

package/dist/scripts/codex-fast-mode-profile-propagation-check.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { emitGate } from './sks-1-18-gate-lib.js';
-import { runNativeCliSwarmCheck } from './lib/native-cli-session-swarm-check-lib.js';
-const report = runNativeCliSwarmCheck({
-    agents: 1,
-    workItems: 1,
-    backend: 'codex-sdk',
-    reportName: 'codex-fast-mode-profile-propagation.json'
-});
-emitGate('codex:fast-mode-profile-propagation', { backend: report.backend, service_tier: report.fast_mode_propagation.service_tier });
-//# sourceMappingURL=codex-fast-mode-profile-propagation-check.js.map

package/dist/scripts/codex-history-search-check.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/source-intelligence/codex-history-search.js');
-const codexHome = path.join(root, '.sneakoscope', 'tmp', 'codex-history-fixture');
-const sessionDir = path.join(codexHome, 'sessions');
-fs.mkdirSync(sessionDir, { recursive: true });
-fs.writeFileSync(path.join(sessionDir, 'session.jsonl'), '{"message":"Ultra Stability search target"}\n{"message":"secondary"}\n');
-const report = await mod.searchCodexHistory({ codexHome, query: 'ultra stability', maxFiles: 10, maxResults: 5 });
-const out = path.join(root, '.sneakoscope', 'reports', 'codex-history-search.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(report.ok === true, 'Codex history search report must be ok', report);
-assertGate(report.case_insensitive === true, 'Codex history search must default to case-insensitive matching', report);
-assertGate(report.results.length === 1, 'Codex history search fixture should find one match', report);
-emitGate('source-intelligence:codex-history-search', { results: report.results.length, files_scanned: report.files_scanned });
-//# sourceMappingURL=codex-history-search-check.js.map

package/dist/scripts/codex-hook-semantic-check.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { codexHookWarningCheck } from '../core/codex-compat/codex-hook-warning-detector.js';
-const result = await codexHookWarningCheck(process.cwd());
-console.log(JSON.stringify({
-    schema: 'sks.codex-hook-semantic-check.v2',
-    ok: result.ok,
-    baseline: result.baseline,
-    warnings_count: result.warnings_count,
-    issues_by_category: result.issues_by_category,
-    events: result.events
-}, null, 2));
-if (!result.ok)
-    process.exitCode = 1;
-//# sourceMappingURL=codex-hook-semantic-check.js.map

package/dist/scripts/codex-hook-strict-subset-check.js

@@ -1,61 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { detectCodexHookOutputWarnings } from '../core/codex-compat/codex-hook-warning-detector.js';
-const cases = [
-    {
-        name: 'pretooluse_ask',
-        event: 'PreToolUse',
-        output: { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask' } },
-        category: 'upstream_semantic_unsupported'
-    },
-    {
-        name: 'pretooluse_additional_context',
-        event: 'PreToolUse',
-        output: { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'allowed by schema, banned by SKS' } },
-        category: 'sks_zero_warning_disallowed'
-    },
-    {
-        name: 'snake_case',
-        event: 'PreToolUse',
-        output: { continue: true, permission_decision: 'deny' },
-        category: 'legacy_shape'
-    },
-    {
-        name: 'unknown_field',
-        event: 'Stop',
-        output: { continue: true, unexpected: true },
-        category: 'schema_violation'
-    },
-    {
-        name: 'stop_missing_reason',
-        event: 'Stop',
-        output: { continue: true, decision: 'block' },
-        category: 'upstream_semantic_unsupported'
-    },
-    {
-        name: 'permission_allow_message',
-        event: 'PermissionRequest',
-        output: { continue: true, hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'allow', message: 'ok' } } },
-        category: 'sks_zero_warning_disallowed'
-    }
-];
-const results = [];
-for (const row of cases) {
-    const result = await detectCodexHookOutputWarnings(row.event, row.output);
-    const count = result.issues_by_category?.[row.category] || 0;
-    results.push({
-        name: row.name,
-        ok: count > 0,
-        expected_category: row.category,
-        issues_by_category: result.issues_by_category
-    });
-}
-const ok = results.every((row) => row.ok);
-console.log(JSON.stringify({
-    schema: 'sks.codex-hook-strict-subset-check.v1',
-    ok,
-    results
-}, null, 2));
-if (!ok)
-    process.exitCode = 1;
-//# sourceMappingURL=codex-hook-strict-subset-check.js.map

package/dist/scripts/codex-lb-config-toml-safety-check.js

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-// Production invariant: a codex-lb config write must NEVER corrupt ~/.codex/config.toml,
-// especially on initial install. Every codex-lb writer routes through
-// safeWriteCodexConfigToml, which parse-gates current + next and backs up before mutating.
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const helpers = await importDist('cli/install-helpers.js');
-// Reproduce the on-disk parse smoke the runtime uses (unterminated triple-quote / bad header).
-function parses(text) {
-    const tripleTokens = (String(text).match(/"""|'''/g) || []).length;
-    if (tripleTokens % 2 !== 0)
-        return false;
-    const badHeader = String(text).split('\n').find((l) => /^\s*\[/.test(l) && !/^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/.test(l));
-    return !badHeader;
-}
-const results = [];
-const BASE_URL = 'http://127.0.0.1:2455/backend-api/codex';
-// --- Case 1: fresh/empty config -> codex-lb provider added cleanly, parses ---
-{
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-fresh-'));
-    const cfg = path.join(dir, 'config.toml');
-    const next = helpers.upsertCodexLbConfig('', BASE_URL);
-    const res = await helpers.safeWriteCodexConfigToml(cfg, '', next, 'codex-lb');
-    const after = await fs.readFile(cfg, 'utf8');
-    const ok = res.ok && /\[model_providers\.codex-lb\]/.test(after) && /^model_provider = "codex-lb"/m.test(after) && parses(after);
-    results.push({ case: 'fresh_adds_provider_parseable', ok, status: res.status });
-}
-// --- Case 2: existing config with a multiline string containing a bracketed line
-//     (the upsertTomlTable blind spot) must NEVER be written corrupted ---
-{
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-multiline-'));
-    const cfg = path.join(dir, 'config.toml');
-    const tricky = [
-        'model = "gpt-5.1-codex"',
-        'custom_note = """',
-        'here is a note with a [not-a-real-header] inside a multiline string',
-        'second line',
-        '"""',
-        '',
-        '[mcp_servers.x]',
-        'command = "y"',
-        ''
-    ].join('\n');
-    await fs.writeFile(cfg, tricky);
-    const next = helpers.normalizeCodexFastModeUiConfig(helpers.upsertCodexLbConfig(tricky, BASE_URL));
-    const res = await helpers.safeWriteCodexConfigToml(cfg, tricky, next, 'codex-lb');
-    const after = await fs.readFile(cfg, 'utf8');
-    // INVARIANT: whatever happens, the on-disk config must still parse.
-    const ok = parses(after) && (res.ok ? /\[model_providers\.codex-lb\]/.test(after) : after === tricky);
-    results.push({ case: 'multiline_trap_never_corrupts', ok, status: res.status, on_disk_parses: parses(after) });
-}
-// --- Case 3: an already-unparseable existing config is preserved + backed up, not clobbered ---
-{
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-broken-'));
-    const cfg = path.join(dir, 'config.toml');
-    const broken = 'model = "x"\n[features\nhooks = true\n';
-    await fs.writeFile(cfg, broken);
-    const next = helpers.upsertCodexLbConfig(broken, BASE_URL);
-    const res = await helpers.safeWriteCodexConfigToml(cfg, broken, next, 'codex-lb');
-    const after = await fs.readFile(cfg, 'utf8');
-    const backups = (await fs.readdir(dir)).filter((f) => f.includes('.sks-codex-lb-unparseable-'));
-    const ok = res.status === 'unparseable_config_preserved' && after === broken && backups.length >= 1;
-    results.push({ case: 'unparseable_preserved_backed_up', ok, status: res.status });
-}
-// --- Case 4: idempotent — re-applying when already configured is a no-op ('present') ---
-{
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-idem-'));
-    const cfg = path.join(dir, 'config.toml');
-    const seeded = helpers.upsertCodexLbConfig('', BASE_URL);
-    await helpers.safeWriteCodexConfigToml(cfg, '', seeded, 'codex-lb');
-    const cur = await fs.readFile(cfg, 'utf8');
-    const next = helpers.upsertCodexLbConfig(cur, BASE_URL);
-    const res = await helpers.safeWriteCodexConfigToml(cfg, cur, next, 'codex-lb');
-    results.push({ case: 'idempotent_present', ok: res.status === 'present' && res.changed === false, status: res.status });
-}
-const ok = results.every((r) => r.ok);
-if (!ok) {
-    console.error(JSON.stringify({ ok: false, message: 'codex-lb config TOML-safety regression failed', results }, null, 2));
-    process.exit(1);
-}
-emitGate('codex-lb:config-toml-safety', { cases: results.map((r) => r.case) });
-//# sourceMappingURL=codex-lb-config-toml-safety-check.js.map